Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion

Backdoor SHA256 hashes:
9ceb37c55a1e55afe50e2b892d3756e5c89ee71131245f5da72c1b8dd0005b99
6eec892054e6cb1addbde2fa92d3ccb5d56d37aa992f81f9106aaf124b9d3525
20f09959706797b81b2a4de627c01d0c0d890d142954d455a0e50f7811bdc951
7ff329e0a20a96dd4d0e8b42a216ade348161566250b7e39e166031c881f34d0
12435ae8d190c4a0cae64009416f17195dbb7f7ca732b69e6178e9dd4c66fcb2
19f94c523d4488a50584dd3d96500820e4f479cadcef4d14a1dd7cf939cd3154
dc4277e5f6e76ef3f5c0da8a6703acd69a017747aac0413f7248911e51214641
b66dab4fbdae54eea59313fd218abc96a54c0bbf0ab774dbe8776de9322510b2
D095E636400EE633AE22488BBA77D53F584F1FF279FD604BB6E60C0211D1957E
99027cf9f6fcce91d1d08a8cc15043912e51aff82804d4678c7b453e55899404
3d753a9e8e6ab22a498f7c6702910ea3e77ca8ef524f8435ac4614a9d4cbf345
c75c5d7b4bdedcf5c6e78305d62f6830f4766c4517cf650a36493e19574c507d
a133b1839bad5616b51915f2dfe420be36e05ee5c5f1c8e81220177b14c12848
01ef286f55d1a15f308f2bed102bec0916d799d8e883a48117cecfe713a74267
1887185af63849aea9cdd7855b638110447842f178fca9cd81b76c72acd16e68
3dcad2fdebd68390ea4a80398593cfc3360ef51291b853cb3e9a607915ec74cb
aa7bc130c5340364f61074f7c98651e80db3b08396a4fb449f614e0889acfdd3
c0b1deaa2598936c284684b50a652f98771a129e882f382ac011d5ab984fd132
1185fa967aa989d5e072577e493d2b307c48181480129d4c45337da64d5bfd25
d18019064e5903dcf7c29921c10a7a90176cccd55d9cf3ba1e3e9805c1364df1
644b88ce37d8ccb9258df6fcd74c6b485323dcfd9feb0f961252e6c311241703
0b2e9328d82a045ce00f6b1b449ae32d8997f631f691350ea39d85c78eb66216
18e2b7df374a838a57ebf3186b13a26e523cf964afde50b7ba765ed4d5509670
d72ea22e6f35e848a2e5870863e410f0434013ad43c3f5b6935168fc07c7d7b0

Earth Lusca’s archive:
aa5ff64cadabd2d8aba7963c2372270bbfdafa155f85a9a9ec2b57674cf8173e


Earth Lusca’s LNK file:
FCF0CF8A19FA16792771310462D36F3C059ED7D36EF90899316313F4626D24D7


Earth Lusca’s DLL decryptor:
FD3205EDEF38248C059898274F5818ABBCB757ADB707CA47580D4B16772A38D1


Extracted C&Cs:
39.105.121.123:9999
39.107.101.26:9999
47.94.223.124:9999
47.94.166.190:9999
59.110.136.109:9999
123.56.45.175:81
123.57.223.22:81
39.107.75.91:81
182.92.101.4:81
123.56.45.175:443
123.57.223.22:443
39.107.75.91:443
182.92.101.4:443
123.57.6.3:81
39.107.67.131:81
101.200.156.217:81
182.92.155.149:81
123.57.218.176:81
47.99.78.41:443
47.96.97.77:443
47.96.5.136:443
47.96.135.49:443
116.62.120.97:443
123.57.60.94:443
39.105.107.130:443
182.92.233.242:443
47.94.229.250:443
182.92.169.60:443
47.96.160.242:443
116.62.231.152:443
47.96.13.99:443
47.98.173.175:443
47.97.109.62:443
139.224.254.181:53
139.224.45.232:53
47.102.36.88:53
47.101.43.111:53
139.196.196.178:53
123.57.60.94:8081
39.105.107.130:8081
182.92.233.242:8081
47.94.229.250:8081
182.92.169.60:8081
47.100.98.234:443
106.14.175.235:443
106.15.193.24:443
47.100.121.195:443
47.100.59.42:443
47.100.160.164:80
47.101.48.168:80
47.101.137.187:8032
139.196.89.210:80
106.15.90.75:80
47.93.38.26:53
39.106.135.228:53
47.95.198.228:53
101.201.68.58:53
47.94.194.248:53
182.92.243.166:1433
47.95.168.191:80
47.98.121.179:443
47.96.106.167:443
116.62.142.53:443
121.40.70.23:443
118.31.53.137:443
47.98.50.198:80
39.106.40.121:53
101.200.63.187:53
101.201.35.96:53
39.107.231.100:53
47.95.12.152:53
47.94.20.102:443
101.201.69.42:443
47.94.202.137:443
47.94.193.44:443
47.94.227.15:443
47.94.143.163:443
39.106.13.202:443
47.93.47.186:443
59.110.226.246:443
47.94.200.23:443